Elasticsearch 6.4.0, 6.4.1, 6.4.2 Information Disclosure Vulnerability - Windows

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Open Source IPS: Suricata

Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection IDS, inline intrusion prevention IPS, network security monitoring NSM and offline pcap processing. Suricata inspects the network traffic usi...

Elasticsearch ESA-2018-16

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; wh...

Elastic Stack 6.4.3 and 5.6.13 security update

Elasticsearch information disclosure ESA-2018-16 Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same...

org.elasticsearch:elasticsearch-river-rabbitmq (>=0.17.0, <=1.0.0) potentially affected by CVE-2018-11087 via com.rabbitmq:amqp-client (2.5.1)

com.rabbitmq:amqp-client MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq =0.17.0, =1.0.0 Source cves: CVE-2018-11087 Source advisory:...

org.elasticsearch:elasticsearch-river-rabbitmq (1.5.0) potentially affected by CVE-2018-11087 via com.rabbitmq:amqp-client (3.1.0)

com.rabbitmq:amqp-client MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq 1.5.0 Source cves: CVE-2018-11087 Source advisory:...

org.elasticsearch:elasticsearch-river-rabbitmq (>=0.11.0, <=0.13.1), org.iplantc.core:metadactyl (1.8.4) potentially affected by CVE-2018-11087 via com.rabbitmq:amqp-client (2.1.0)

com.rabbitmq:amqp-client MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq =0.11.0, =0.13.1 - org.iplantc.core:metadactyl 1.8.4 Source cves...

org.elasticsearch:elasticsearch-river-rabbitmq (1.1.0) potentially affected by CVE-2018-11087 via com.rabbitmq:amqp-client (2.7.0)

com.rabbitmq:amqp-client MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq 1.1.0 Source cves: CVE-2018-11087 Source advisory:...

org.apache.camel:camel-rabbitmq (>=2.13.0, <=2.13.4), org.axonframework:axon-amqp (2.1) +3 more potentially affected by CVE-2018-11087 via com.rabbitmq:amqp-client (3.2.2)

com.rabbitmq:amqp-client MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.camel:camel-rabbitmq =2.13.0, =2.1, =2.1, =2.6 Source cves: CVE-2018-11087 Source advisory:...

Remote code execution occurs in Apache Solr

Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

cn.howardliu:gear-es (>=1.0.0-release, <=1.0.1-release), com.digitalpebble.stormcrawler:storm-crawler-aws (>=0.9, <=0.10) +24 more potentially affected by CVE-2018-1332 via org.apache.storm:storm-core (0.10.0)

org.apache.storm:storm-core MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-core and may be impacted: - cn.howardliu:gear-es =1.0.0-release, =0.9, =0.9, =0.9, =0.9, =0.9, =0.9, =0.0.5, =0.0.5, =0.0.18, =0.0.1...

org.apache.storm:flux-core (>=1.2.0, <=1.2.1), org.apache.storm:storm-elasticsearch-examples (>=1.2.0, <=1.2.1) +14 more potentially affected by CVE-2018-8008 via org.apache.storm:storm-core (>=1.2.0, <=1.2.1)

org.apache.storm:storm-core MAVEN version =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.0, =1.2.1 and more Source cves: CVE-2018-8008 Source advisory: OSV:GHSA-898J-5CC8-CMF5...

FitMetrix Exposes Millions of Customer Details, Accessed by Criminals

FitMetrix, which makes performance-tracking software that gym owners can brand and offer to their customers, has exposed millions of customers’​ records, because they were maintaining completely open cloud servers. To boot, the records were accessed by cybercriminals prior to the public access...

Elasticsearch '_snapshot API' Information Disclosure Vulnerability - Linux

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Elasticsearch '_snapshot API' Information Disclosure Vulnerability - Windows

Elasticsearch is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Information Disclosure

elasticsearch is vulnerable to information disclosure. The library does not properly filter the settings API, allowing a malicious user can pass a query to the cluster/settings API to gain access to sensitive configuration information like passwords, tokens or usernames...

CVE-2018-3831

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This...

Elasticsearch ESA-2018-15

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This...

Elastic Cloud Enterprise (ECE) Information Disclosure Vulnerability

Elastic Cloud Enterprise ECE is a suite of software packages for managing, monitoring, and configuring Elasticsearch, Kibana, and X-Pack from Elasticsearch Netherlands. An information disclosure vulnerability exists in Elastic Cloud Enterprise ECE, which can be exploited by an attacker to obtain...

Elasticsearch repository-azure information disclosure vulnerability

Elasticsearch is the Netherlands Elasticsearch company based on Lucene built a set of open source distributed RESTful search engine , it is mainly used in cloud computing , and supports the use of JSON via HTTP for data indexing . repository-azure is one of the repository plugin . An information...